Keep mesh-lab at its trunk and build the release judge with a cache of its own

Review of #329: mesh-lab's replays run with the container runtime's socket, so
a same-named branch must never be what runs there; the shared Go cache and HOME
are writable by a pull request's own script, so the judge kept for a head must
not be built from them (issue 704, issue 482). A forge answer naming no branch
is an error, and a trunk is the branch a repository follows, not a name.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/builder/check.go

@@ -429,6 +429,11 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 		if dir == name || !safeName.MatchString(dir) {
 			continue
 		}
+		if dir == "mesh-lab" && b.Else != "" {
+			// **mesh-lab is read at its trunk, always** (novox/hq ADR 0358): its replays run with the container
+			// runtime's socket, so a branch of a release's name — which anyone may create — is never what runs there.
+			b.Ref, b.Else = b.Else, ""
+		}
 		if err := cloneAt(b.Repository, b.Ref, b.Else, dir); err != nil {
 			return CheckVerdict{}, fmt.Errorf("beside it, %w", err)
 		}
@@ -1130,8 +1135,12 @@ func releaseJudge(ctx context.Context, run, plain Runner, spec CheckSpec, root s
 			}
 		}
 	}
+	// **Built with a cache of its own, never the workspace's** (novox/hq issue 482): the workspace's Go cache and HOME are
+	// written by every pull request's own script, so a poisoned cache entry or Go environment file would otherwise be
+	// built into the judge kept for this head. A fresh cache under this check's root, made before anything of the
+	// change runs, and no Go environment file.
 	if _, err := run(ctx, root, "docker", inToolchain(filepath.Join(root, dir),
-		[]string{"CGO_ENABLED=0", "GOFLAGS=-mod=vendor", "GOPROXY=off", "GOCACHE=" + filepath.Join(filepath.Dir(root), "go-cache")},
+		[]string{"CGO_ENABLED=0", "GOFLAGS=-mod=vendor", "GOPROXY=off", "GOENV=off", "GOCACHE=" + judgeGoCache(root)},
 		"go", "build", "-o", bin, "./cmd/mesh-controller")...); err != nil {
 		return "", "", fmt.Errorf("the controller of %s does not build%s: %w", spec.Release, with, err)
 	}
@@ -1141,6 +1150,10 @@ func releaseJudge(ctx context.Context, run, plain Runner, spec CheckSpec, root s
 	return bin, dir, nil
 }
 
+// judgeGoCache is the Go cache a release branch's judge is built with: fresh for each check, under its root, which is
+// emptied before the check clones anything — never the workspace's shared cache.
+func judgeGoCache(root string) string { return filepath.Join(root, "judge-go-cache") }
+
 // judgesKept is how many release-branch judges a judge cache keeps: a head moved past is not built from again.
 const judgesKept = 4